cnvd-2019-36853
Vulnerability from cnvd

Title: 多款Siemens产品拒绝服务漏洞(CNVD-2019-36853)

Description:

Siemens SIMATIC CFU PA等都是德国西门子(Siemens)公司的产品。Siemens SIMATIC CFU PA是一款紧凑型现场设备。SIMATIC ET 200AL是一款分布式I/O系统模块。SIMATIC ET 200M是一款用于高密度通道应用的控制柜的模块化I/O系统模块。

多款Siemens产品中存在拒绝服务漏洞,攻击者可借助大量特制的UDP数据包利用该漏洞造成拒绝服务。

Severity:

Patch Name: 多款Siemens产品拒绝服务漏洞(CNVD-2019-36853)的补丁

Patch Description:

Siemens SIMATIC CFU PA等都是德国西门子(Siemens)公司的产品。Siemens SIMATIC CFU PA是一款紧凑型现场设备。SIMATIC ET 200AL是一款分布式I/O系统模块。SIMATIC ET 200M是一款用于高密度通道应用的控制柜的模块化I/O系统模块。

多款Siemens产品中存在拒绝服务漏洞,攻击者可借助大量特制的UDP数据包利用该漏洞造成拒绝服务。目前,供应商发布了安全公告及相关补丁信息,修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序,请及时关注更新: https://cert-portal.siemens.com/productcert/pdf/ssa-473245.pdf

Reference: https://vigilance.fr/vulnerability/SIMATIC-denial-of-service-via-Profinet-UDP-Packets-30562

Impacted products
Name
['Siemens SIMATIC S7-410 V8', 'Siemens SIMATIC ET 200AL', 'Siemens SIMATIC ET 200ecoPN', 'Siemens SIMATIC ET 200M', 'Siemens SIMATIC ET 200pro', 'Siemens SIMATIC ET 200S', 'Siemens SINAMICS DCM', 'Siemens SINAMICS DCP', 'Siemens DK Standard Ethernet Controller', 'Siemens SINUMERIK 840D sl', 'Siemens SIMATIC PN/PN Coupler', 'Siemens SIMATIC HMI Comfort Panels 4" - 22"', 'Siemens SIMATIC S7-1500 CPU family', 'Siemens SINAMICS S150', 'Siemens SIMATIC HMI Comfort Outdoor Panels 7" & 15"', 'Siemens SIMATIC S7-300 CPU family (incl. F)', 'Siemens SIMATIC WinAC RTX (F) 2010', 'Siemens SIMATIC S7-400 PN/DP V7 (incl. F)', 'Siemens SINUMERIK 828D < V4.8 SP5', 'Siemens SINAMICS G110M V4.7 (Control Unit) < V4.7 SP10 HF5', 'Siemens SINAMICS G120 V4.7 (Control Unit) < V4.7 SP10 HF5', 'Siemens SINAMICS GH150 V4.7 (Control Unit)', 'Siemens SINAMICS GL150 V4.7 (Control Unit)', 'Siemens SINAMICS GM150 V4.7 (Control Unit)', 'Siemens SINAMICS S110 (Control Unit)', 'Siemens SINAMICS SL150 V4.7 (Control Unit)', 'Siemens SINAMICS SM120 V4.7 (Control Unit)', 'Siemens EK-ERTEC 200', 'Siemens EK-ERTEC 200P', 'SIEMENS SIMATIC S7-1200 CPU family', 'Siemens SINAMICS G150 (Control Unit)', 'Siemens SINAMICS S120 V4.7 (Control Unit and CBE20)', 'Siemens SIMATIC CFU PA <1.2.0', 'Siemens SIMATIC ET 200MP IM 155-5 PN BA <4.2.3', 'Siemens SIMATIC ET 200MP IM 155-5 PN HF', 'Siemens SIMATIC ET 200MP IM 155-5 PN ST', 'Siemens SIMATIC ET 200SP IM 155-6 PN BA', 'Siemens SIMATIC ET 200SP IM 155-6 PN HA', 'Siemens SIMATIC ET 200SP IM 155-6 PN HF <4.2.2', 'Siemens SIMATIC ET 200SP IM 155-6 PN HS', 'Siemens SIMATIC ET 200SP IM 155-6 PN ST', 'Siemens SIMATIC ET 200SP IM 155-6 PN/2 HF <4.2.2', 'Siemens SIMATIC ET 200SP IM 155-6 PN/3 HF <4.2.1', 'Siemens SIMATIC HMI KTP Mobile Panels', 'Siemens SIMATIC PROFINET Driver <2.1', 'Siemens SIMATIC S7-400 V6 (incl. F) and below', 'Siemens SIMATIC S7-400H V6 <6.0.9', 'Siemens SINAMICS G130 v4.7 (Control Unit and CBE20)']
Show details on source website


{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-10936"
    }
  },
  "description": "Siemens SIMATIC CFU PA\u7b49\u90fd\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Siemens SIMATIC CFU PA\u662f\u4e00\u6b3e\u7d27\u51d1\u578b\u73b0\u573a\u8bbe\u5907\u3002SIMATIC ET 200AL\u662f\u4e00\u6b3e\u5206\u5e03\u5f0fI/O\u7cfb\u7edf\u6a21\u5757\u3002SIMATIC ET 200M\u662f\u4e00\u6b3e\u7528\u4e8e\u9ad8\u5bc6\u5ea6\u901a\u9053\u5e94\u7528\u7684\u63a7\u5236\u67dc\u7684\u6a21\u5757\u5316I/O\u7cfb\u7edf\u6a21\u5757\u3002\n\n\u591a\u6b3eSiemens\u4ea7\u54c1\u4e2d\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u501f\u52a9\u5927\u91cf\u7279\u5236\u7684UDP\u6570\u636e\u5305\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002",
  "discovererName": "unknown",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-473245.pdf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-36853",
  "openTime": "2019-10-23",
  "patchDescription": "Siemens SIMATIC CFU PA\u7b49\u90fd\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Siemens SIMATIC CFU PA\u662f\u4e00\u6b3e\u7d27\u51d1\u578b\u73b0\u573a\u8bbe\u5907\u3002SIMATIC ET 200AL\u662f\u4e00\u6b3e\u5206\u5e03\u5f0fI/O\u7cfb\u7edf\u6a21\u5757\u3002SIMATIC ET 200M\u662f\u4e00\u6b3e\u7528\u4e8e\u9ad8\u5bc6\u5ea6\u901a\u9053\u5e94\u7528\u7684\u63a7\u5236\u67dc\u7684\u6a21\u5757\u5316I/O\u7cfb\u7edf\u6a21\u5757\u3002\r\n\r\n\u591a\u6b3eSiemens\u4ea7\u54c1\u4e2d\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u501f\u52a9\u5927\u91cf\u7279\u5236\u7684UDP\u6570\u636e\u5305\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eSiemens\u4ea7\u54c1\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2019-36853\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Siemens SIMATIC S7-410 V8",
      "Siemens SIMATIC ET 200AL",
      "Siemens SIMATIC ET 200ecoPN",
      "Siemens SIMATIC ET 200M",
      "Siemens SIMATIC ET 200pro",
      "Siemens SIMATIC ET 200S",
      "Siemens SINAMICS DCM",
      "Siemens SINAMICS DCP",
      "Siemens DK Standard Ethernet Controller",
      "Siemens SINUMERIK 840D sl",
      "Siemens SIMATIC PN/PN Coupler",
      "Siemens SIMATIC HMI Comfort Panels 4\" - 22\"",
      "Siemens SIMATIC S7-1500 CPU family",
      "Siemens SINAMICS S150",
      "Siemens SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\"",
      "Siemens SIMATIC S7-300 CPU family (incl. F)",
      "Siemens SIMATIC WinAC RTX (F) 2010",
      "Siemens SIMATIC S7-400 PN/DP V7 (incl. F)",
      "Siemens SINUMERIK 828D  \u003c V4.8 SP5",
      "Siemens SINAMICS G110M V4.7 (Control Unit) \u003c V4.7 SP10 HF5",
      "Siemens SINAMICS G120 V4.7 (Control Unit) \u003c V4.7 SP10 HF5",
      "Siemens SINAMICS GH150 V4.7 (Control Unit)",
      "Siemens SINAMICS GL150 V4.7 (Control Unit)",
      "Siemens SINAMICS GM150 V4.7 (Control Unit)",
      "Siemens SINAMICS S110 (Control Unit)",
      "Siemens SINAMICS SL150 V4.7 (Control Unit)",
      "Siemens SINAMICS SM120 V4.7 (Control Unit)",
      "Siemens EK-ERTEC 200",
      "Siemens EK-ERTEC 200P",
      "SIEMENS SIMATIC S7-1200 CPU family",
      "Siemens SINAMICS G150 (Control Unit)",
      "Siemens SINAMICS S120 V4.7 (Control Unit and CBE20)",
      "Siemens SIMATIC CFU PA \u003c1.2.0",
      "Siemens SIMATIC ET 200MP IM 155-5 PN BA \u003c4.2.3",
      "Siemens SIMATIC ET 200MP IM 155-5 PN HF",
      "Siemens SIMATIC ET 200MP IM 155-5 PN ST",
      "Siemens SIMATIC ET 200SP IM 155-6 PN BA",
      "Siemens SIMATIC ET 200SP IM 155-6 PN HA",
      "Siemens SIMATIC ET 200SP IM 155-6 PN HF \u003c4.2.2",
      "Siemens SIMATIC ET 200SP IM 155-6 PN HS",
      "Siemens SIMATIC ET 200SP IM 155-6 PN ST",
      "Siemens SIMATIC ET 200SP IM 155-6 PN/2 HF \u003c4.2.2",
      "Siemens SIMATIC ET 200SP IM 155-6 PN/3 HF \u003c4.2.1",
      "Siemens SIMATIC HMI KTP Mobile Panels",
      "Siemens SIMATIC PROFINET Driver \u003c2.1",
      "Siemens SIMATIC S7-400 V6 (incl. F) and below",
      "Siemens SIMATIC S7-400H V6 \u003c6.0.9",
      "Siemens SINAMICS G130 v4.7 (Control Unit and CBE20)"
    ]
  },
  "referenceLink": "https://vigilance.fr/vulnerability/SIMATIC-denial-of-service-via-Profinet-UDP-Packets-30562",
  "serverity": "\u4e2d",
  "submitTime": "2019-10-11",
  "title": "\u591a\u6b3eSiemens\u4ea7\u54c1\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2019-36853\uff09"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…